fix registrar writebacks and own the State Hub access map

Ignore generated WORK-RECORDS.md/.custodian-brief.md in the registrar git
precondition, commit identifier writebacks even when registration is
incomplete, and name the remaining records in the error. Add
config/state-hub-access.yaml as the single source for the AGENTS.md port
map, rendered by rmgr scaffold and refreshed with --refresh-hub-access.

Assistant: grok
Assistant-Session: 01a04996-76e8-7f53-b971-1885cfbed436

src/repo_manager/commands/scaffold.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from typing import Any
 
 from repo_manager.gitops import GitError, commit_paths, is_git_repo
+from repo_manager.hub_access import apply_hub_access_block, render_hub_access_block
 from repo_manager.standards import FLAVOR_MARKER_PREFIX, expected_workplan_prefix
 from repo_manager.time import utc_today
 
@@ -121,7 +122,9 @@ def scaffold_repository(
         "AGENTS.md",
         f"# Agent instructions — {slug}\n\n"
         f"Orient: {'GOAL.md' if prj else 'INTENT.md'} → SCOPE.md → workplans/.\n"
-        f"Workplan prefix: `{prefix}-`.\n",
+        f"Workplan prefix: `{prefix}-`.\n\n"
+        "## State Hub Integration\n\n"
+        f"{render_hub_access_block()}\n",
     )
     if prj:
         today = utc_today().isoformat()
@@ -190,3 +193,36 @@ def scaffold_repository(
     if not written:
         evidence["noop"] = True
     return CommandResult("applied", evidence, None, cid)
+
+
+def refresh_hub_access(path: Path, *, commit: bool = True) -> CommandResult:
+    """Replace the State Hub access table in AGENTS.md from the canonical map."""
+    cid = str(uuid.uuid4())
+    dest = path.expanduser().resolve()
+    agents = dest / "AGENTS.md"
+    evidence: dict[str, Any] = {"path": str(dest), "file": "AGENTS.md"}
+    if not agents.is_file():
+        return CommandResult(
+            "rejected",
+            evidence,
+            {"message": "AGENTS.md is missing; scaffold the repository first"},
+            cid,
+        )
+    original = agents.read_text(encoding="utf-8")
+    updated, action = apply_hub_access_block(original)
+    evidence["action"] = action
+    if action == "noop":
+        evidence["noop"] = True
+        return CommandResult("applied", evidence, None, cid)
+    agents.write_text(updated, encoding="utf-8")
+    evidence["written"] = ["AGENTS.md"]
+    if commit and is_git_repo(dest):
+        try:
+            evidence["git_sha"] = commit_paths(
+                dest,
+                ["AGENTS.md"],
+                "docs(agents): refresh State Hub access map from repo-manager",
+            )
+        except GitError as exc:
+            return CommandResult("failed", evidence, {"message": str(exc)}, cid)
+    return CommandResult("applied", evidence, None, cid)